1

We have 3 VM's (All win 2012 R2) deployed on Azure. Today i noticed that since Dec 9th, there have been several Logon Failures messages getting logged in the Security logs on all the servers. It appears that there are random sign-in attempts. Few examples of the errors are below. As you can see the Account Names are random and none of those users belongs to our AD deployment. I'm not sure if this is like a Brute Force attack, but this is concerning me. Our Intrusion Detection software identified the IP's of those Logon attempts and blocked the IP's as it considered it as an Intrusion attempts. So far it has blocked more than 400 IP's. But, my concern is, how can i permanently block those connections? Also, what are the downsides of those IP's blacklisting? Would appreciate any assistance.

==============================

An account failed to log on.

Subject: Security ID: NULL SID Account Name: -

Account Domain:

Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed: Security ID: NULL SID Account Name: BLARSEN

==============

An account failed to log on.

Subject: Security ID: NULL SID Account Name: -

Account Domain:

Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed: Security ID: NULL SID Account Name: Jobs

===============

An account failed to log on.

Subject: Security ID: NULL SID Account Name: -

Account Domain:

Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed: Security ID: NULL SID Account Name: EDUARDO

  • 1
    I'm not sure if this is like a Brute Force attack, but this is concerning me - It sure looks like a brute force attempt to log on to the servers. my concern is, how can i permanently block those connections? Doesn't your IDS/IPS permanently block them? If not, why not? Can it be configured to permanently block them? what are the downsides of those IP's blacklisting? - They're trying to hack into your servers, why would there be a downside to permanently blocking them? – joeqwerty Dec 16 '18 at 6:18
  • Also, Logon Type 3 is a network logon attempt but it isn't a Remote Interactive logon attempt (TS/RDS) so what services are you exposing on these servers? What do your NSG rules look like? – joeqwerty Dec 16 '18 at 6:18
  • Thanks for the response @joeqwerty. Yes, IDS is configured to permanently block those IP's permanently, however like i said, it has so far blocked more than 400 IP's and still i continue to see those event logs. I suppose you're right about not having any downsides to permanently blocking them. We're only using this infra to host our web app. So, only inbound connections over port 443 is allowed and RDP over 339 is allowed. Anything else you'd recommend apart from IDS to strengthen the security? – Shahid Shaikh Dec 16 '18 at 7:00
  • 1. Only allow incoming RDP connections from known ip addresses. 2. Is the webapp used by the public at large? – joeqwerty Dec 16 '18 at 15:00
  • Thanks @joeqwerty. I changed the Incoming RDP connections setting, No, it's used by our sales users mostly, when they're on the go. Internal users can access it as an intranet site. – Shahid Shaikh Dec 17 '18 at 9:50
0

To address a couple points:

  • Brute force attack: I agree that this is most likely what this is
  • Downsides to blocking those IPs: If these IPs are spoofed, or used from VPN services, there could be future legitimate traffic that gets blocked if you ban them. I would argue the risk is low and you could address those as they get reported.
  • How to block: this depends on your security design. Firewall is a great place to start. Sounds like your IDS is already doing a good job.
  • Why are these ports available to the public in the first place? You ought to re-evaluate your security design and see if there's a way to restrict access to these entry points. There's seldom a good reason to directly expose Windows server ports to the public. Even an IIS server ought to have a good front end filtering traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.